Ransomware Network Indicator Analysis
Spot ransomware-style C2 beaconing, Tor connections and exfiltration in Zeek and NetFlow logs
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent how to examine network traffic logs (Zeek conn.log files or NetFlow exports) for patterns linked to ransomware, such as regular 'phone home' callbacks to attacker servers, connections to Tor exit nodes, and unusually large outbound data transfers that may signal data theft before encryption. The agent follows a set procedure and can produce a structured JSON report with a composite risk score mapped to MITRE ATT&CK techniques. It is meant to assist security analysts, not replace them.
Great for
- SOC analysts running threat hunts over existing Zeek or NetFlow logs
- Incident responders checking for possible pre-encryption data exfiltration
- Security engineers prototyping detection logic for ransomware network behaviour
Skip it if
- Live blocking or real-time prevention, since it works on exported log files after the fact (it is not an intrusion prevention product)
- Anyone without log data or security context, because outputs need expert interpretation and can produce false positives on normal periodic traffic such as software updates
Try asking
- “Analyze this Zeek conn.log for beaconing patterns with low coefficient of variation in connection intervals”
- “Check these NetFlow exports for connections to Tor exit nodes and large outbound transfers”
- “Build a ransomware network risk report with MITRE ATT&CK mapping from yesterday's firewall logs”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-ransomware-network-indicators.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-ransomware-network-indicators.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-ransomware-network-indicators.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review the script before running it on sensitive logs, and run it on copies or in an isolated environment
- Treat beaconing and exfiltration scores as leads to verify, since benign services can look similar
- Refresh the Tor exit list regularly, as the set of exit nodes changes over time
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.